High severity · published Jun 11, 2020
CVE-2020-11090
In Indy Node 1.12.2, there is an Uncontrolled Resource Consumption vulnerability
7.5
CVSS
2.2%
EPSS
No
On KEV
Description
In Indy Node 1.12.2, there is an Uncontrolled Resource Consumption vulnerability. Indy Node has a bug in TAA handling code. The current primary can be crashed with a malformed transaction from a client, which leads to a view change. Repeated rapid view changes have the potential of bringing down the network. This is fixed in version 1.12.3.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.2% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IN
Indy-node · Linuxfoundation
1.12.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-11090
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-11090
Release Notes
https://github.com/hyperledger/indy-node/blob/master/CHANGELOG.md#1123
Third Party Advisory
https://github.com/hyperledger/indy-node/security/advisories/GHSA-3gw4-m5w7-v89c
Third Party Advisory
https://pypi.org/project/indy-node/1.12.3/
More from Indy-node
8.8
CVE-2022-31020
Indy Node is the server portion of a distributed ledger purpose-built for decentralized identity
7.5
CVE-2022-31006
indy-node is the server portion of Hyperledger Indy, a distributed ledger purpose-built for decentralized identity
7.5
CVE-2020-11093
Hyperledger Indy Node is the server portion of a distributed ledger purpose-built for decentralized identity